Coldcard hardware wallet firmware vulnerability has drained 1,432–1,816 BTC ($92M–$116M) from over 5,200 addresses since late July.
Security & Exploits ·
A firmware vulnerability in Coldcard hardware wallets has resulted in confirmed and estimated losses spanning a wide range. CryptoQuant confirmed 1,432 BTC in losses, while Galaxy Research identified a high-confidence minimum of 1,730 BTC and noted that 1,816 BTC represents a potential rather than confirmed figure. TRM Labs separately estimated attackers moved approximately 1,816 BTC from more than 5,200 addresses across four separate transfer waves beginning in late July.
The loss estimates diverge because different analysis firms apply distinct methodologies and verification thresholds. CryptoQuant's lower figure reflects only addresses publicly disclosed by victims and validated through on-chain patterns, whereas Galaxy Research's higher estimate incorporates additional high-confidence signals. TRM Labs' assessment encompasses the full scope of transfers it detected across multiple stages, though CryptoQuant notes its statistics may increase as additional victims come forward with disclosures.
The precise total loss remains uncertain, with confirmed figures ranging from 1,432 BTC to a potential 1,816 BTC. The gap between estimates hinges on how rigorously each firm verifies victim claims and on-chain activity. Further victim disclosures could move confirmed losses higher and narrow the range between current estimates.